Probabilistic Structural Health Monitoring 
of the Orbiter Wing Leading Edge 


Keng C. Yap\ Ph.D. 

Boeing Space Exploration, Houston, TX 77059 
Jesus Macias^ 

United Space Alliance (USA), Houston, TX 77058 

Mohamed Kaouk^, Ph.D., Tammy L. Gafka^, Justin H. Kerr"^, Ph.D. 
National Aeronautics and Space Administration (NASA), Houston, TX 77058 


A structural health monitoring (SHM) system can contribute to the risk management of a 
structure operating under hazardous conditions. An example is the Wing Leading Edge 
Impact Detection System (WLEIDS) that monitors the debris hazards to the Space Shuttle 
Orbiter’s Reinforced Carbon-Carbon (RCC) panels. Since Return-to-Flight (RTF) after the 
Columbia accident, WLEIDS was developed and subsequently deployed on board the 
Orbiter to detect ascent and on-orbit debris impacts, so as to support the assessment of wing 
leading edge structural integrity prior to Orbiter re-entry. As SHM is inherently an inverse 
problem, the analyses involved, including those performed for WLEIDS, tend to be 
associated with signiflcant uncertainty. The use of probabilistic approaches to handle the 
uncertainty has resulted in the successful implementation of many development and 
application milestones. 


Nomenclature 


G^ax = Maximum acceleration response 

Grms = Root-mean-square of acceleration response 

3 = Logarithmic decay 

P = Damage probability 

Pj = Probability of impact 

Pc = Joint probability of critical damage 

Pen ^ Conditional probability of critical damage given an impact has occurred 

Pm = Probability of multi-sensor corroboration being stronger than model experience 

Pp = Probability of multi-sensor corroboration being weaker than flight experience 

^diag = Diagonal corroboration ratio of multi-sensor response 

rhorz = Horizontal corroboration ratio of multi-sensor response 

7sen = Sensor configuration test scaling factor 

7pan = RCC panel-to-panel test scaling factor 

Itst = Test article boundary condition scaling factor 

^mea = Tcst measurement scaling factor 

^dam = DmnsLgQ-Grnax Correlation factor 

d = Damage size (inch) 
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I. Introduction 

E ngineering risk management provides a means to ensure the long term operational viability of structures, 
particularly amid changing structural characteristics, operating environment, and functional requirements. To 
mitigate risk, preventative measures can be taken to minimize the structure’s vulnerability to its hazardous 
environment via design changes, structural reinforcement, environment changes, and hazard avoidance or shielding. 
However, hazard prevention alone may not be economically feasible to eliminate the risk of operating a structure 
over its entire design life. In which case structural health monitoring (SHM) can be used to manage the residual risk 
of potential adverse consequences by assessing the change in mechanical properties that reflect the structure’s health 
condition (Ref 1-6), or by detecting the hazard events that potentially threaten the structure’s integrity (Ref. 7-8). 
The Space Shuttle Columbia re-entry breakup was caused by External Tank (ET) foam debris release from the left 
bipod ramp and subsequent impact on the port wing leading edge during ascent (Figure la). The accident 
investigation found brittle failure of the Reinforced Carbon-Carbon (RCC) panel upon foam impact under known 
and possible conditions experienced during Columbia flight STS- 107 (Figure lb). Following the accident, the 
debris hazard was significantly reduced by the ET foam improvements, but not completely eliminated. The Wing 
heading Edge Impact Detection System (WLEIDS) was developed under the Shuttle Program’s Retum-to-Flight 
(RTF) initiative to better monitor the debris threat to the Orbiter. The operational concept of the SHM system is that 
risk mitigating action to avoid loss of vehicle and crew can take place on-orbit between the time of detection and the 
time of re-entry. As SHM is inherently an inverse problem, a detected modality may not precisely characterize the 
particular source of fault condition or hazard event. Hence, analyses involved in SHM tend to be associated with 
significant uncertainty. Over the course of WLEIDS operations, the use of probabilistic approaches to handle the 
uncertainty has resulted in the successful implementation of many development and application milestones. 



Figure 1. Foam Debris Hazard. 


Since Shuttle flight STS- 114, the primary goal of WLEIDS has been to detect ascent debris impacts to help the 
Mission Management Team (MMT) make critical safety decisions. Since flight STS-121, the system’s role has been 
extended to monitor micrometeoroid and orbital debris (MM/OD) impacts. During each flight, the system uses 
accelerometers to detect dynamic response caused by impacts on the RCC panels. Other sensors such as acoustic- 
emission and fiber optic had also been considered (Ref 9). Impact indications gathered from WLEIDS and the 
ground/vehicle camera surveillance systems would provide inputs to the on-orbit inspection of RCC. An early 
general inspection using the Laser Dynamic Range Imaging (LDRI) on the Orbiter Boom Sensor System (OBSS) is 
scheduled on Flight Day 2 to scan for ascent debris damage. The MMT then decides if a more detailed focus 
inspection is needed to determine if damage is severe enough to merit repair. Late inspection is performed to detect 
potential damages mainly due to MM/OD. All information regarding debris impacts is then used in an integrated 
assessment of structural integrity prior to Orbiter re-entry. 

During early inspection for flight STS- 132, the LDRI could not be properly positioned because its pan-tilt unit 
cable was snagged by a protruding sensor. This resulted in limited coverage and resolution that prevented clearing 
the RCC from ascent debris damage. While an additional extra- vehicular activity was planned to free the cable, the 
Orbiter Project Office (OPO) reviewed the limited early inspection results supplemented by other imagery surveys. 
On Flight Day 5, additional results from WLEIDS helped the OPO reach a consensus that the RCC was at a low risk 
of having sustained any unacceptable damage from expected ascent debris (foam and ice). The MMT subsequently 
proceeded with the mission while deferring the re-entry clearance to routine late inspection. 
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The use of WLEIDS in making this critical decision came at a time when most of the analytical development 
milestones had been achieved, particularly through Probabilistic Risk Analysis (PRA) (Ref. 10). A computational 
PRA typically involves the use of complex physical “stress-strength” models to represent the associated failure 
criteria (Ref. 11). While these models are developed based on deterministic knowledge of a particular physical 
phenomenon, probabilistic methods are used to account for their uncertainty. In space launches, these models have 
been used to assess range safety involving risk of injury or loss of life in populated areas following a launch accident 
(Ref. 12-13), due to inert debris from launch vehicle, blast effects from solid or liquid propellant explosion (Ref. 
14), and health effects from dispersion of toxic propellant plumes (Ref 15). They have also been used in dealing 
with MM/OD risk (Ref 16), Shuttle and ISS subsystem component criticality assessments (Ref 17-19), and 
determination of Orbiter re-entry overflight hazards (Ref 20-21). For WLEIDS, PRA is used to quantify the 
elevated risk as the conditional probability of damage, in the event that an impact is indicated by the system. 

II. Instrumentation 

The WLEIDS hardware system (Figure 2) was developed by Invocon (Ref 22) and maintained by NASA (Ref 
23-24). During initial development, impact testing at Southwest Research Institute (SwRI) showed that the system 
is capable of detecting an RCC impact from foam similar in size and velocity to the Columbia incident. The 
hardware was later certified and flown aboard the STS- 114 mission of the Orbiter Discovery. The on-board 
instrumentation consists of 132 accelerometers and 44 resistive temperature sensors mounted in the wing spars 
behind the RCC panels. Groups of three accelerometers and one temperature sensor are connected to one of the 44 
battery-powered wireless data acquisition sensor units to record accelerations using a 20 kHz sampling rate with a 6 
kHz anti-aliasing filter. The sensor units are mounted at two separate locations or “farms” in each wing, with 14 
units inside the aft wing cavity and 8 inside the forward wing glove (Figure 3). Grouping the units into farms 
instead of distributing them across the wings allowed ease of operation including battery replacement and post- flight 
data download through wheel well access panels. This also avoids damaging the sensitive wing struts due to battery 
hazard or loose instrumentation. The sensor units transmit the data to a wing relay unit via radio frequency (RE), 
then to a cabin relay unit via an RS-485 serial bus cable. The cabin relay unit transmits the data via RE to the laptop 
receiver unit, which then dumps the data to the laptop on board the flight deck. The data are finally downlinked to 
the ground via satellite KU-band for analysis. 



Figure 2. WLEIDS Hardware Overview. 
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Wing Cavity Sensor Unit Farm (AFT) 

• 14 Sensor Un its (1 battery/unit) 

• 1 Wing Relay Unit 


Wing Glove Sensor Unit Farm (FWD) 

•8 Sensor Units (1 battery/unit) 

• 1 Wing Relay Unit 


Crew Cabin Equipment 

• 2 Cabin Relay Units 

•2 Laptop ReceiverUnits 

• 2 Laptops (primary & backup) 


Sensors 

• 1 32 Accelerometers (66/wing) 

• 44 Temperature Sensors (22/win g) 
J • Behind spar(RCC #1-19 & chine) 


Wing Spar Wing Cavity/Glove Crew Cabin Ground 



Figure 3. WLEIDS Instrumentation. 


III. Ascent Monitoring 

The exterior of the ET is covered with foam to insulate the tank filled with cryogenic liquid propellants from 
ascent aero-heating, and to prevent prelaunch icing that has high damage potential to the Orbiter when it sheds. The 
foam insulation was expected to stay on, yet foam shedding has been common since early flights. Although Orbiters 
have been damaged by ascent debris, the threat from foam shedding was not well understood until after ST- 107. 
The Columbia tragedy prompted improvements to the ET foam design, spraying technique, and understanding of the 
integrated debris risk. The foam threat was mitigated by these improvements, but not eliminated. This is evident in 
post-Columbia flights, particularly the unexpectedly large foam debris spray during flight STS- 127; hence the 
continued need for WLEIDS. Figure 4 shows the sensor configuration used in ascent monitoring, with sensors 
mounted across 22 RCC panels and the chine area of a wing. Each sensor unit is connected to three accelerometers 
typically distributed across two panels for fault tolerance. There are redundant accelerometers, particularly at RCC 
#8-12 that are most critical for protecting the vehicle from re-entry aero-heating. 


Wing Glove Units (Fwd) Wing Cavity Units (Aft) 



Figure 4. Ascent Monitoring Sensor Configuration. 
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Before launch, the sensor units are programmed to take acceleration measurements in trigger mode. When 
triggered by liftoff vibrations, the units begin to store the data in internal memory for 10 minutes, going well past ET 
separation. The data take produces 12 million points for each of the 132 channels. Each sensor unit post-processes 
the G-time data into Grms using 256-point (0.0128 sec) windows with 50% overlap, and generates 312.5 Hz high- 
pass filtered periodic summary files that select the highest Grms point over each channel for every Vi-SQcond period. 
The sensor units return to idle mode after processing the data. Following orbit insertion, the crew sets up the on- 
board primary and backup laptops. Commands are sent to the sensor units to download the data to the laptops. As 
data files are written to the laptops, they are downlinked to the ground analysis team. Instead of the large volume of 
raw G-time data files, the Grms summary files are downlinked with priority given to the most critical RCC panels 
(Figure 4). The summary greatly reduces the data while providing sufficient details to identify specific areas of 
interest where impacts are suspected. A command can then be uplinked to obtain a section of the processed data, or 
a limited number of /i-second raw data files for further analysis. The two-step approach avoids the need for a large 
communication bandwidth to complete the analysis. After the Orbiter lands and is towed back to the processing 
facility, the full set of raw data files are downloaded by ground operations personnel for post- flight study. 

During the ascent phase, the Shuttle undergoes a dynamic aero-acoustic environment marked by events such as 
Space Shuttle Main Engine (SSME) ignition. Solid Rocket Booster (SRB) ignition. Roll Maneuvers, Maximum 
Dynamic Pressure (Max Q) and SRB separation, and ET separation (Figure 5). Structural responses to dynamic 
loadings are recorded by WLEIDS. The challenge for the ground analysis team is to discern from all these dynamic 
responses whether a debris impact has occurred, and if so, determine when and where it occurred, and how severe it 
is. Figure 5 shows an example plot of summary data for the port wing. Among the major dynamic events shown, 
SRB and ET separations are distinctly seen because they are discrete and global. Chine sensors typically show 
higher response sensitivity (Figure 5). Certain RCC panel interfaces (e.g., 11/12, sometimes 6/7 and 16/17) may 
show a higher level of noise and repeated transients that are not attributed to real debris impacts. The summary files 
are screened to find areas of interest where potential impact events are suspected to have occurred. The screening 
can be slow and labor intensive. Experimentation using general purpose data mining tools (clustering, outlier 
method, decision tree) (Ref 25-26) was conducted in flights STS-115 and 116. An expert systems approach was 
later employed to build an automatic detection tool by searching for data characteristics based on impact simulation 
and test experience. Further assessment demonstrated the tool’s ability to produce a manageable list of points 
without missing any impact indications that an experienced analyst would have found. As the tool became a 
significant time saver while safeguarding against visual prevalence that the analysts might experience, the analysis 
procedure was revised to adopt a computer aided process that takes advantage of the use of automatic detection. 



Figure 5. Ascent Processed Data Summary. 
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Subsequent investigation following the summary analysis requires !/ 2 -second raw G-time response data to be 
downlinked at the points-of-interest. The raw data analysis procedure was formalized by establishing a set of impact 
criteria. The first sign of impact that an analyst looks for is significant transient or sudden elevated response above 
noise in the G- and G^^^-time response plots (Figure 6a-b) over mission elapsed time. Due to the random vibration 
environment that the vehicles experience, the noise level changes over the ascent flight phase. The noise band 
(shaded yellow) is defined by the median absolute deviation (MAD) about the median over the Vi-second signal 
window, which provides a robust measure of signal variability with minimal influence from the transient. The shock 
response is expected to show a quick rise in amplitude followed by damped oscillation. The analyst checks to make 
sure that the transient is not due to an expected mission event (e.g., SRB and ET separations), which typically causes 
global dynamic response across both wings. Spectral analysis via Fourier transformation of the signal is used to find 
high frequency response typically excited by an impact (Ref 27) (Figure 6c). Aero-acoustic and electrical transients 
often do not meet this criterion. Other analysis tools based on normal probability, wavelet transformation, cross- 
correlation, multi-sensor signal demodulation, and spectral energy statistics were also developed. An initiative to 
improve the screening capability for on-orbit monitoring expanded the impact criteria by considering damping 
characteristics, multi-sensor corroborations, and nonlinear phenomena. The damping and multi-sensor criteria were 
also applied to ascent impact identification. An algorithm was developed to estimate the damping or logarithmic 
decay based on a fitted curve (Figure 6d). The damping criterion helps screen out much of the internal structural 
noise that has been known to exhibit a higher rate of signal decay than a real debris impact. Multi-sensor criterion 
exploits significant corroborating response from adjacent sensors to substantiate an impact indication. This criterion 
will be further discussed in the next section. 


a) G-time Response 



h) Grms-time Response 




c) Power Spectral Density 


0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 

Frequency (Hz) 


d) Damping 



106.35 106.4 106.45 106.5 106.55 106.6 106.65 106.7 106.75 106.8 
Mission Elapsed Time (s) 


Figure 6. Example Analysis Plots. 

In a typical Shuttle ascent flight, the system detects as many as 100 indications that are mostly associated with 
low energy, non-damaging, small foam (known as “popcorn”) debris impacts. Popcorn foam releases occur as ET 
aero-heating causes an internal pressure build-up and burst of small pores in the foam insulation. Figure 7 shows a 
typical ET aero-heating curve superimposed on the temporal distribution of WEE IDS ascent debris impact 
indications averaged over flights STS- 114 thru 120. A strong correlation between them can be clearly observed. 
However, while the aero-heating curve exhibits a clear “double-hump” characteristic, the second WLEIDS data 
“hump” is much less pronounced. This is thought to be due to significantly reduced atmospheric pressure and drag 
that resulted in much lower energy impacts. The correlation provided the first strong evidence of the system 
registering real impacts. The evidence helped establish high confidence in the system’s sensitivity to detect more 
severe foam impacts, such as the one that critically damaged the Shuttle Columbia. 
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Figure 7. Correlation of Ascent Debris Impacts with ET Aero-heating. 

While the large number of impact indications from each flight provided valuable insights to the ascent debris 
environment, they also posed an operational dilemma. The analysis team would not be able to find and report all of 
the impact indications within a practical time frame during the mission. Reporting all ascent debris impacts without 
inferring on their severity would not be very helpful either. It was realized that performing a severity assessment is 
key to a more robust decision process. Ascent analysis for a severity assessment was supported by an extensive 
testing and model development program. An important milestone was the development of a reporting threshold 
using the data acquired from SwRI ballistic impact tests (Figure 8), where debris samples (ET foam, ablator, ice) of 
various sizes and velocities were projected at full-scale wing leading edge test articles representing various designs 
and regions of the Orbiter wing structure. Using a test-based PRA approach, the Program selected a reporting 
threshold of 1.0 Grms, a value below which there is high confidence that an impact would not be damaging. The 
application of reporting threshold to summary data analysis significantly reduced the report turnaround time by 
cutting down on the number of points-of-interest and !/ 2 -second raw data downloads that need to be analyzed. Since 
flight STS-121, this greatly enhanced the operational feasibility and sustainability of the system by reducing the 
analysis time and personnel resources required for mission support. 



Figure 8. Ballistic Impact Test with a Full-scale Wing Leading Edge Test Article. 


Following the development of a reporting threshold, model-based PRA of expected ascent debris (foam and ice) 
impacts was performed to establish the damaging threshold based on probability of damage. The analysis scope was 
limited to estimating the damage threshold and probability without addressing the damage extent or the overall 
Orbiter re-entry risk. The PRA effort involved vehicle thumper testing at Kennedy Space Center (KSC), 
NASTRAN modeling and simulation, probabilistic LS-DYNA damage threshold analysis, sensitivity analysis, and 
statistical damage analysis of model runs. Models developed in LS-DYNA (Figure 9a) (Ref 28) and NASTRAN 
(Figure 9b) were correlated to SwRI ballistic impact tests. The NASTRAN high-fidelity vehicle wing model 
(complete with spar, fittings, and RCC panels) was later validated by a series of low energy non-destructive vehicle 
impact tests performed using a thumper and arm assembly. As part of the pre-test planning, a test article experiment 
was conducted to help modify the thumper design for better load consistency. The test article and vehicle models 
were used to ensure safe thumping. The calibrated thumper was then used to carefully tap the RCCs of OV-105 
(Figure 9c) (Ref 29). A total of five locations were thumped on fourteen panels (RCC #5-18) for each wing. Non- 
destructive evaluation (NDE) was conducted to verify that the thumper test had not caused any damage to the RCCs 
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(Ref. 30). Following the test, NASTRAN model runs were generated with measured inputs from thumper test for 
model validation and uncertainty assessment. The modeling uncertainty was assessed by statistically averaging over 
all model errors, although more advanced techniques had been considered for predictive accuracy assessment (Ref. 
31-33). Due to the significant modeling uncertainty, and without regularization of model update (Ref 34), the 
model was more suitable for probabilistic as opposed to deterministic analysis. 



Figure 1. PRA Modeling and Testing. 


In computational PRAs, probabilistic “stress-strength” formulation based on a phenomenological model is 
typically used to predict the reliability of structural elements by estimating the probability distribution of mechanical 
“stress” applied to a structural component and of the “strength” of its constituting material (Ref 11). The 
probability of failure of the component is then calculated as the probability that the applied stress may exceed the 
inherent strength. A similar formulation was used in the ascent severity assessment. About 300 model runs were 
generated using the inputs of LS-DYNA threshold cases to calibrate the damage evaluation. The analysis of these 
cases for each debris type (foam, ice) over normally distributed material variations produced the statistical 
distribution of maximum principal stress (Figure 10a). Sensitivity analysis was used to determine the model run 
matrix, where a total of 34 runs per debris type on one panel (RCC #9) were generated at selected parameter 
variations. As for risk analysis, 1050 model runs were generated for each debris type for RCC #9-17, while 450 
runs were generated for the smaller RCC #5-7, and 700 runs for RCC #8 due to consideration of a large debris 
contact footprint relative to the panel size. For each debris type, the debris weight, impact location, angle, and 
velocity were varied in the simulations. This allowed the PRA to take into account the varying response sensitivity 
(due to mass and geometry) across the wing. For most panels, there were nine impact locations (3x3 grid) on both 
lower and upper surfaces, and three locations along the apex (Figure 10b). The midpoint of each surface 
corresponds to the impact location of the LS-DYNA threshold cases. The narrower panels (RCC #5-7) had only two 
columns of impact grid points instead of three. Debris weight was varied between 0.01-0.1 lb for foam and 0.005- 
0.06 lb for ice. Impact angles were varied with pitch ranging between O-IO"", while azimuth was kept at 5°. Debris 
impact velocity was varied based on the LS-DYNA threshold runs for each debris weight, with values ranging from 
250 to 2200 ft/sec for foam, and 100 to 1700 ft/sec for ice. 


a) Probabilistic Damage Evaluation 



b) Model Impact Locations 



Figure 2. Probabilistic Impact Analysis. 
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The analysis took into account the varying response sensitivity across the wing (due to RCC panel mass, 
geometry, and boundary conditions), and impact uncertainty (location, angle, velocity, debris type). Maximum 
principal stress and dynamic response were calculated from the model with response correlated with the thumper 
test. The response data went through flight-consistent post-processing to obtain the maximum Grms- Maximum 
principal stress was used to estimate the damage probability. Relating maximum G^ms to damage probability 
allowed the damage risk to be quantified based on accelerometer measurements acquired from an impact indication. 
Figure 11 shows the damage probability contours over panel number and maximum response, with the lowest 
maximum G^ms conservatively selected over debris types and impact surfaces (lower, apex, upper). These curves 
show that the higher the response, the higher the damage probability for the same panel (as expected). They also 
reflect the different response sensitivity across the panels. The larger panels (RCC #8-9) tend to have lower 
sensitivity, hence lower response for the same damage risk. During flight, when the system registers an ascent 
impact indication, the impact magnitude and impacted RCC panel number would be used to infer the associated 
damage risk. The ascent impact indications would then be ranked in the order of importance (e.g., for focused 
inspection) based on their damage risk. The analysis is limited to providing risk acceptance rationale only when the 
damage probability falls under 1/100. An impact similar to one brought down the Shuttle Columbia could have 
produced a response over 40 Grms for RCC #8, with a damage risk well above 1/100. The analysis also found that 
the previously selected reporting threshold of 1.0 Grms did not exceed a damage probability of 1/1000 for any panels, 
thus verifying that using this value as the lowest threshold of concern is appropriate for mission operations. 



RCC Panel Number 

Figure 3. Damage Risk from Ascent Debris Impact Indication. 

As a mission support example, the ascent analysis was completed within twelve hours of launch during flight 
STS- 132. Only one probable impact indication from starboard RCC #6 was reported, with the risk of RCC damage 
from expected ascent debris (foam and ice) estimated at no more than 1/1 000 ^ As previously mentioned, an OBSS 
positioning problem prompted the OPO to assess the RCC damage risk before clearing the vehicle from ascent 
damage and proceeding with the preplanned mission activities. As part of the decision process, the concern of 
damaging impacts being potentially masked by aero-acoustic noise during the period of high dynamic pressure was 
raised. Damage risk was conservatively assessed by treating the Max Q response (highest noise after take-off) as an 
impact response. The results showed that most panels had an acceptable damage risk below 1/1000, and for those 
few with higher damage risk below 1/500, the concern was sufficiently alleviated by supplementary imagery and 
inspections. The PRA results from WLEIDS played a key role in making a critical flight safety decision. 

IV. On-orbit Monitoring 

Micrometeoroids are interplanetary particles broken off from larger debris that usually date back to the formation 
of the solar system. The material may range from stony silicate minerals to metallic (iron, nickel). Man-made 
orbital debris (e.g., fragments from satellites and rockets) also pose serious risk of collision with space structures. 
Although undesirable, MM/OD impacts are common during Shuttle missions, evident by small craters on the RCCs, 
thermal tiles, and radiator (Ref 35). During flight STS-121, the system demonstrated its capability in monitoring 
for MM/OD impacts. Data gathered from flight STS-1 14 were used to set the triggering parameters in the firmware. 
The capability has since been put in use to guide the late inspection (Ref 36). 


^ The indication is not necessarily the most severe impact (i.e., the highest damage probability) from the flight, as other more 
severe indications may not have been reported because their impact magnitudes were below the reporting threshold of 1.0 Grms- 
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During on-orbit monitoring, the sensor units are divided into two groups (Figure 12) per wing that cycle through 
idle and trigger modes for the remaining flight. Limited battery capacity under the extreme thermal environment 
does not permit continuous monitoring. Hardwiring to the vehicle power source had been considered but not 
implemented due to cost and noise concerns. Sensor units put in trigger mode consume battery power at a much 
higher rate than in idle mode. As the Orbiter changes its attitude over time, the MM/OD risk profile passes through 
elevated periods, mainly during early and late inspections, as well as docking and undocking with the ISS. An 
optimal on-orbit monitoring plan activates the sensors into trigger mode during these elevated risk periods, with 
priority given to warmer temperatures for better use of battery capacity, and earlier flight time when there are more 
options for further inspection or repair. The number of starts and stops is also minimized to simplify the operations 
and limit high transient current draws. The on-orbit operation leaves a substantial amount of nominal risk periods 
unmonitored. Thus the system cannot be used to completely mitigate MM/OD risk to the RCC. 

Wing Glove Units (Fwd) Wing Cavity Units (Aft) 

Sensor 
Group 
1 

Chine 



Figure 4. On-orbit Monitoring Sensor Configurations. 



The criteria used for MM/OD impact identification include those for ascent. However for on-orbit monitoring, 
evaluating these criteria based on one sensor alone can lead to false positives; numerous triggers that passed these 
criteria were later cleared by post-landing ground inspection, as the expected damage could not be substantiated by 
the inspection results. An initiative prior to flight STS- 126 improved the on-orbit monitoring capability by 
screening out the previous triggers as spurious (structural noise) or anomalous (not the high risk impacts as tested or 
modeled). The effort led to the development of a multi-sensor discriminator that takes the corroborating response 
from other sensors adjacent to the peak response into account. Response ratios (r^/«g, Vhorz) calculated from diagonal 
and horizontal corroborations (Figure 13) are evaluated and checked against their thresholds established from model 
and test. There can be two, three, or four sensors (excluding redundancy) monitoring an indicated panel. With two 
sensors, either diagonal or horizontal corroboration is available, but not both. With three, diagonal, horizontal, or 
both may be available depending on the G^ax location. With four, both diagonal and horizontal are available. Multi- 
sensor criterion supports a probabilistic evaluation. When only one of the two corroborations is available, each ratio 
is compared to a univariate distribution of flight and model data. When both are available, a bivariate distribution is 
used. The latter mostly benefits analysis of the critical panels (RCC #8-12) due to higher sensor density (Figure 12). 
The impact probability is estimated as 


Pi- Pm! {Pm+Pf), 


( 1 ) 


where Pm is the probability of corroboration ratio being above those from model, i.e. true impacts substantiated by 
significant corroborations, and Pp is the probability of corroboration ratio being below those from flight, i.e. 
spurious impacts substantiated by weak corroborations. 


^dia2 

^horz G/torz / 


Gdiag 

f i 

Impacted 
^ RCC 

Gftorz 


% 


Adjacent 

RCC 


= Maximum response 
0 = Corroborating response 
O = No corroborating response 
0 = Not monitoring 


Figure 5. Multi-sensor Corroboration Ratios. 
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Given a probable impact indication from WLEIDS, it is essential to address the severity of an MM/OD impact 
event that puts the Orbiter in an elevated risk situation. The impact severity is expressed in terms of expected 
damage size (with uncertainty) and damage risk (probability of damage size exceeding some critical value). The 
damage allowable (critical damage size) depends on re-entry aero-heating, with values ranging from 0.08 to 1.0 inch 
over different RCC panels and surfaces (typically lowest at the apex and highest on the top surface). The inference 
of severity from response magnitude is quite different from that of ascent debris due to the different damage 
mechanism associated with hypervelocity impact phenomenon that excites higher frequency response (above 4 
kHz). To assess the severity, the joint probability of critical damage is expressed as 

Pc = Pen Pi, (2) 


where Pen is the conditional probability of critical damage given an impact, and Pj is the probability of impact (Ref 
16). The value of Pj is estimated from multi-sensor criterion, while Pen is estimated based on test and model 
experience. Hypervelocity impact tests (Figure 14a) were conducted at NASA White Sands Test Facility (WSTF) to 
investigate the effect of an MM/OD impact. A total of 20 shots were fired using A1 2017-T4 spherical projectiles to 
simulate micrometeoroids. Figure 14b shows the correlation between response and damage extent. 


a) Hypervelocity Test Setup 



b) Damage Extent from Test 



Figure 6. MM/OD Impact Test. 


Test experience is drawn upon to estimate damage for a probable MM/OD impact indication. However, flight 
response has much lower sensitivity (about three times) than test and hence must be scaled. Several scaling factors 
derived from test data and model simulations are involved, and there is uncertainty associated with each of them. 
Due to reduced on-orbit sensor density, the number of active sensors around an indicated panel is different from test. 
While the test has sensors on all four comers around the impacted panel, flight typically has only three or two. This 
difference is compensated by a sensor configuration scaling factor, Xsem which was obtained using test cases (RCC 
#16) and model simulations (multiple panels). A panel-to-panel scaling factor, is needed because an indicated 
panel is not necessarily the test panel (RCC #16). The factor is calculated by comparing Gmax from RCC #5-17 
impact simulations to those of RCC #16. Due to the limited number of panels modeled, RCC #5 or #17 were used 
for panels further inboard or outboard. Another scaling factor, 2^^, is used to compensate for the higher test article 
response relative to vehicle, as test spar edge vibrates more freely than full vehicle spar. The test article scaling 
factor is calculated by comparing RCC #16 simulations from the test article to the wing model. The cases were 
selected from 1 1 non-thm-hole tests with four sensors per test, totaling 44 responses. The hardware measurement 
scaling factor lynea was obtained by comparing the original and reprocessed test responses. To be consistent with 
flight hardware, the original test data were resampled from 51.2 kHz to 20 kHz with anti-aliasing at 6 kHz. The 
damage- correlation (Figure 14) was modeled using an inverse Weibull function. The distribution of correlation 
factor Xdam was obtained from test to account for substrate damage uncertainty. The distribution of Xsem ^pan and 2^? 
were modeled as a 3 -parameter Weibull, while Xmea was modeled as a bimodal Weibull, and Xdam as Gaussian. To 
account for the uncertainty of these factors, statistical sampling (Ref. 37) based on these modeled distributions was 
used when performing the Monte Carlo analysis of damage size. The different damage estimates allowed us to 
define the conditional critical damage probability as 

Pen = P{d>d\ (3) 

where d is the damage size estimated from scaled G^ax, and d* is the critical damage size or exposed RCC substrate 
for the most critical re-entry aero-heating zone on a panel. Figure 15 shows the Pen curves over flight response. In 
general, higher response, less sensitive panels, and fewer active sensors contribute to higher damage probability. 
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4-sensor 3-sensor 




2-sensor 1 -sensor 




Figure 7. Critical MM/OD Damage Probability. 

As an example MM/OD impact severity assessment, an on-orbit trigger from flight STS- 125 indicated starboard 
RCC #11 with a response magnitude of 0.47 Gy^ax (Figure 16a). The indication was corroborated by two other 
sensors outboard diagonal and horizontal from the maximum response, with corroboration ratios calculated as r^iag = 
0.26/0.47 = 0.55 and r^orz = 0.46/0.47. Both ratios exceeded their minimum thresholds for passing the multi-sensor 
criterion. The critical damage size {(f) for RCC #11 is 0.16 inch. Figure 16b shows the corresponding probability 
distribution of damage size, where the probability of exceeding the critical value was estimated as 

Pc/i = P{d>0AG') = 8% ~ 1 in 12. (4) 

It is possible to estimate the probability of thru-hole and onset damage as shown in the plot. However, the critical 
damage probability remains most relevant to an inspection decision because it is consistent with the damage criteria 
used for Orbiter re-entry. 



Substrate Damage Size, (inch) 
Figure 8. Example MM/OD Impact Case. 
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V. Conclusions and Future Development 

The debris hazard environment experienced by the Orbiter wing leading edge presented a challenging risk 
management problem. The problem was reconditioned by the development of WLEIDS such that the pertinent 
flight risk has become more manageable through hazard monitoring. The wireless instrumentation overcame many 
difficulties associated with incorporating the system into a completed structure, and provided a practical and cost 
effective platform on which an integrated impact sensing, signal processing, and analysis operation could be 
implemented. Due to strong development and continuous improvement efforts, WLEIDS has evolved into a fully 
operational structural health monitoring system that is now an integral part of critical decision making for Orbiter re- 
entry safety. While the main purpose of WLEIDS has been to monitor ascent debris impacts, future launch vehicles 
will likely have an in-line design that will not expose the spacecraft to the same ascent vulnerability as the Shuttle. 
Therefore, the use of such monitoring systems for future manned space missions would instead focus on MM/OD 
impact detection. The main challenge is dealing with hypervelocity impact of medium size particles that are not 
easily tracked and yet large enough to cause serious damage (Ref 38). The technology developed for WLEIDS, 
including its wireless instrumentation, interface firmware, and various impact analysis tools, will benefit future 
structural health monitoring for safer human transportation, exploration, and habitation of space. In particular, the 
advanced MM/OD impact criteria, as well as the probabilistic risk analysis approach developed for this system will 
contribute to a more reliable and robust impact detection and severity assessment. Meanwhile, new developments in 
sensor technology (Ref 39-41) and energy harvesting techniques (Ref 42) promise to revolutionize the future 
design of structural health monitoring systems. 
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